Month: August 2016

more on Microsoft UEFI Secure Boot golden key news

~ hucktech ~ Leave a comment

There are a few news stories coming out saying that the recent Microsoft Secure Boot stories are mostly false, pointing to a Steve Gibson video podcast.

If someone had some good technical background on this story, please leave a Comment to this post, thanks!

https://redmondmag.com/articles/2016/08/17/windows-secure-boot-slip-up.aspx

Kurt Mackie has a story in Redmond Magazine about the recent Microsoft Secure Boot news:

[…] There were no actual software keys involved when anonymous researchers claimed that Microsoft had leaked so-called “golden keys” to the Windows secure boot protection scheme, according to an industry veteran. That point of view was offered by Steve Gibson, president and founder of Gibson Research Corp., a small software development firm in Laguna Hills, Calif. “It was completely wrongly reported” by the press, Gibson said in a “Security Now” show yesterday. Gibson is cohost on the show, which is published by the Twit network. “It was nice work,” Gibson said about the researchers’ findings, “but the whole golden key was an absolute red herring referring to the notion of backdoor systems. But this wasn’t that. It was a mistake.” […] “What this actually was was an implementation design error in the handling of boot permission policies which can be used to trick older versions of the UEFI secure boot manager using some components of an update. So the so-called ‘Redstone’ version of Windows 10, which is version 1607, we know it as the ‘anniversary update,’ it added some new technology in the concept of supplemental secure boot policies, which can, for example, be used for test-signing development code. And of course, that could also be [used for running] malicious rootkits and so on.” […]

http://www.winbeta.org/news/microsofts-golden-key-agenda-actuality

Kareem Anderson of WinBeta has a similar story:

Microsoft’s ‘Golden key’ is more agenda than actuality “None of that is true. Complete misreporting.”

Microsoft removes Firewire from kernel debugger

~ hucktech ~ Leave a comment

The Windows kernel debugger needs to operate even when some device drivers fail, and for other reasons, the debugger can’t use the normal Windows drivers for remoting the debugger over serial, network, USB, Firewire (1394), so the debugger needs to write it’s own driver and do other hacks to remote itself. In the beginning, serial was the only requirement, but later faster cables were needed, like USB and 1394.

Well, it looks like Firewire is fading away, Microsoft has removed 1394 support from the mainstream release of the kernel debugger, only keeping it in the WDK build. Also, AFAIK, this is the first time the Windows debugger is being built separately like this.

https://blogs.msdn.microsoft.com/windbg/2016/08/11/kd-1394-work-around/

 

FWTS v16.08.01 released

~ hucktech ~ Leave a comment

Alex Hung of Canonical announced v16.08.01 of FWTS, the FirmWare Test Suite.

There are a few new ACPI tests in this release:

  * acpi: nfit: add ACPI NFIT test
  * lib: acpi: add support for MPST
  * acpi: mpst: add ACPI MPST test
  * lib: acpi: add support for PMTT
  * acpi: pmtt: add ACPI PMTT test
  * ACPICA: Update to version 20160729

See the release notes for the list of bugfixes.

https://launchpad.net/ubuntu/+source/fwts
http://fwts.ubuntu.com/release/fwts-V16.08.01.tar.gz
https://launchpad.net/~firmware-testing-team/+archive/ubuntu/ppa-fwts-stable
https://wiki.ubuntu.com/FirmwareTestSuite/ReleaseNotes/16.08.01

USaBUSe

~ hucktech ~ Leave a comment

Jenny List has a story on Hackaday about the DEF CON 24 presentation on USB attacks by Dominic White and Rogan Dawes of Sensepost:

[…] Our subject today is a DEF CON talk courtesy of [Dominic White] and [Rogan Dawes] entitled “Universal Serial aBUSe“, and it details a USB attack in which they create an innocuous USB stick that emulates a keyboard and mouse which is shared across a WiFi network via a VNC server. This gives an attacker (who can gain momentary physical access to a USB port to install the device) a way into the machine that completely bypasses all network and other security measures. Their hardware features an AVR and an ESP8266, the former for USB and HID work and the latter to do the heavy lifting and provide WiFi. They started with a Cactus Micro Rev2, but graduated to their own compatible board to make the device more suitable to pose as a USB stick. Both hardware and software files can be found on their GitHub repository, with the software being a fork of esp-link. They go into significant detail of their development and debugging process, and their write-up should be an interesting read for anyone. Below the break you can find a video description of the attack. It’s not a shock to know that USB ports have such little defense, but it is a sobering moment to realize how far attacks like this one have come into the realm of what is possible. […]

Universal Serial Abuse


https://www.sensepost.com/blog/2016/universal-serial-abuse/
https://github.com/sensepost/USaBUSe

New Linux VM Rowhammer attack

~ hucktech ~ Leave a comment

Catalin Cimpanu has a story in Softpedia about a new use of Rowhammer:

New FFS Rowhammer Attack Hijacks Linux VMs: Attack was successful in tests against Debian and Ubuntu

Researchers from the Vrije University in the Netherlands have revealed a new version of the infamous Rowhammer attack that is effective in compromising Linux VMs, often used for cloud hosting services. The Rowhammer attack was discovered two years ago and caused a lot of stir when researchers disclosed it because it showed how, by bombarding a row of memory cells, an attacker could reverse binary zeros into ones and vice versa. […]

http://news.softpedia.com/news/new-ffs-rowhammer-attack-targets-linux-vm-setups-507290.shtml

VxWorks network vulnerability

~ hucktech ~ Leave a comment

VxWorks: Execute My Packets

Intel SGX tutorial, part 3 underway

~ hucktech ~ 1 Comment

If you haven’t seen the Intel SGX tutorial, the first 2 parts are out, and the 3rd part is nearly out:

https://software.intel.com/en-us/articles/introducing-the-intel-software-guard-extensions-tutorial-series
https://software.intel.com/en-us/articles/intel-software-guard-extensions-tutorial-part-1-foundation
https://software.intel.com/en-us/articles/intel-software-guard-extensions-tutorial-part-2-app-design

It sounds like part3 is nearly out:

https://software.intel.com/en-us/blogs/2016/08/17/part-3-of-the-intel-software-guard-extensions-tutorial-series-is-coming-soon

ThinkPwn updated

~ hucktech ~ Leave a comment

https://github.com/Cr4sh/ThinkPwn/commit/d496e7d9a4bbb1e2903a94802760d52c1e46c037
https://github.com/Cr4sh/ThinkPwn/

UEFI bootloader for Google Fuchsia

~ hucktech ~ 1 Comment

Apparently Google is working on a new OS called Fuchsia, which is not based on Linux, Android, or ChromeOS. One of the components of Fuchsia is Magenta.

I just noticed that Magenta has a UEFI-aware bootloader.

https://github.com/fuchsia-mirror/gigaboot20x6

“This project contains some experiments in software that runs on UEFI firmware for the purpose of exploring UEFI development and bootloader development.”

https://github.com/fuchsia-mirror
https://github.com/fuchsia-mirror/magenta
https://github.com/fuchsia-mirror/magenta/blob/master/docs/index.md
https://github.com/littlekernel/lk

 

CHIPSEC 1.2.4 released

~ hucktech ~ Leave a comment

Chipsec 1.2.4 has been released! There are no release notes, the docs haven’t been updated in the last 6 months, so you have to read the code for any new changes, besides these 3 tweets:

https://github.com/chipsec/chipsec

https://github.com/chipsec/chipsec/commits/master

 

FreeBSD 11.0 RC released

~ hucktech ~ Leave a comment

The first release candidate of FreeBSD 11.0-STABLE is out. Below, excerpted from their release notes, is an excerpt of some of the changes:

Initial support for the ARM AArch64 architecture has been added. [r280259] (Sponsored by The FreeBSD Foundation)

Initial ACPI support has been added for FreeBSD/aarch64. [r284273] (Sponsored by The FreeBSD Foundation)

The uefisign(8) utility has been added. [r279315] (Sponsored by The FreeBSD Foundation)

Support for bzipfs has been added to the EFI loader. [r279950]

The mkimg(1) utility has been updated to support the MBR EFI partition type. [r276893] (Sponsored by The FreeBSD Foundation)

The gpart(8) utility has been updated to include a new attribute for GPT partitions, lenovofix, which when set, which works around BIOS compatibility issues reported on several Lenovo ™ laptops. [r285594] (Sponsored by ScaleEngine, Inc.)

[arm] The arm boot loader, ubldr, is now relocatable. In addition, ubldr.bin is now created during build time, which is a stripped binary with an entry point of 0, providing the ability to specify the load address by running go ${loadaddr} in u-boot. [r282731]

Support for the “Virtual Interrupt Delivery” feature of Intel® VT-x is enabled if supported by the CPU. This feature can be disabled by running sysctl hw.vmm.vmx.use_apic_vid=0. Additionally, to persist this setting across reboots, add hw.vmm.vmx.use_apic_vid=0 to /etc/sysctl.conf. [r260410]

Support for “Posted Interrupt Processing” is enabled if supported by the CPU. This feature can be disabled by running sysctl hw.vmm.vmx.use_apic_pir=0. Additionally, to persist this setting across reboots, add hw.vmm.vmx.use_apic_pir=0 to /etc/sysctl.conf. [r260532]

Support for running a FreeBSD/amd64 Xen guest instance as PVH guest has been added. PVH mode, short for “Para-Virtualized Hardware”, uses para-virtualized drivers for boot and I/O, and uses hardware virtualization extensions for all other tasks, without the need for emulation. [r267536] (Sponsored by Citrix Systems R&D)

The bhyve(8) hypervisor has been updated to support AMD® processors with SVM and AMD-V hardware extensions. [r273375]

The Hyper-V™ drivers have been updated with several enhancements: [r282212] (Sponsored by Microsoft Open Source Technology Center)

A new device control utility, devctl(8) has been added, which allows making administrative changes to individual devices, such as attaching and detaching drivers, and enabling and disabling devices. The devctl(8) utility uses the new devctl(3) library. [r278320]

The pciconf(8) utility has been updated to use the PCI ID database from the misc/pciids package, if present, falling back to the PCI ID database in the FreeBSD base system. [r287522]

The acpi(4) subsystem has been updated to version 20150818. [r287168]

ACPICA has been updated to version 20160527. [r300879]

Firmware for Intel® Centrino™ Wireless-N 105 devices has been added to the base system. [r260552]

The stack protector has been upgraded to the “strong” level, elevating the protection against buffer overflows. While this significantly improves the security of the system, extensive testing was done to ensure there are no measurable side effects in performance or functionality. [r288669]

An issue that could cause a system to hang when entering ACPI S3 state (suspend to RAM) has been corrected in the acpi(4) and pci(4) drivers. [r274386]

Full relnotes:
https://www.freebsd.org/releases/11.0R/relnotes.html
http://www.freebsd.org/news/newsflash.html#event20160813:01

BSODomizer High Def

~ hucktech ~ Leave a comment

“The BSODomizer is a man-in-the-middle device that connects between a target computer and monitor. It intercepts the legitimate video signal and replaces it with a fake BSOD (Blue Screen of Death) or other user-defined image at a pre-configured time interval or when triggered by an infrared remote control. The BSODomizer can automatically detect when the target computer is turned off or restarted, in which case it will revert to the harmless video pass-through mode leaving the user unaware of any wrongdoing. Released in 2008, the original BSODomizer produces a text-only display at 1024×768 resolution and connects to the target through an HD-15/VGA interface. Two CR2032 3V Lithium coin cell batteries provide the required power. It is no longer being produced. BSODomizer HD, created in 2016, is an enhanced, FPGA-based version of the BSODomizer. It features improved graphics interception and triggering capability, and produces a 1920×1080 (1080p) resolution image on any HDMI-compliant display. […]”

http://www.grandideastudio.com/bsodomizer/

FSF asks you to support the Libre Tea Computer Card

~ hucktech ~ Leave a comment

The Free Software Foundation is supporting the Libre Tea Computer Card’s crowdfunding effort.

“The Earth-friendly EOMA68 Computing Devices project is a crowdfunding campaign run on Crowd Supply to produce a line of hardware products that are ecologically responsible and built based on royalty-free, unencumbered hardware standards. […] After working closely with the developers and reviewing a sample test board, we are confident that their plans are to create a device that can achieve our Respects Your Freedom (RYF) certification. […]  The project is being developed by Luke Kenneth Casson Leighton of Rhombus-Tech and is sponsored by Christopher Waid of ThinkPenguin, a company that sells [multiple RYF-certified hardware products. […]  The Libre Tea Computer Card is built with an Allwinner A20 dual core processor configured to use the main CPU for graphics; it has 2 GB of RAM and 8 GB of NAND Flash; […]

https://www.fsf.org/blogs/licensing/support-the-libre-tea-computer-card-a-candidate-for-respects-your-freedom-certification
https://www.crowdsupply.com/eoma68/micro-desktop
https://www.fsf.org/ryf
http://rhombus-tech.net
https://www.thinkpenguin.com/
https://www.parabola.nu/

Microsoft UEFI Secure Boot key problem

~ hucktech ~ Leave a comment

Chris Williams has a story in The Register about some problems that Microsoft is having with UEFI Secure Boot:
Bungling Microsoft singlehandedly proves that golden backdoor keys are a terrible idea
Redmond races to revoke Secure Boot policy

Updated Microsoft leaked the golden keys that unlock Windows-powered tablets, phones and other devices sealed by Secure Boot – and is now scrambling to undo the blunder.

These skeleton keys can be used to install non-Redmond operating systems on locked-down computers. In other words, on devices that do not allow you to disable Secure Boot even if you have administrator rights – such as ARM-based Windows RT tablets – it is now possible to sidestep this block and run, say, GNU/Linux or Android. […]

http://www.theregister.co.uk/2016/08/10/microsoft_secure_boot_ms16_100/